← back
CVE-2021-40868

CVE-2021-40868

EPSS 9.1%
Vexday Risk Score
38Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 9.1%KEV nãoPoC públicaNuclei simMetasploit —Patch —
Lifecycle
21 Sep 2021Published on NVD
22 Sep 2021Public PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.
Affected products
n/a · n/a
public PoCs found — 3
cve_referencepacketstormsecurity.com/files/164255/Cloudron-6.2-Cross-Site-Scripting.htmlunverifiedcve_referencepacketstormsecurity.com/files/164183/Cloudron-6.2-Cross-Site-Scripting.htmlunverifiedexploitdbwww.exploit-db.com/exploits/50317unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/164255/Cloudron-6.2-Cross-Site-Scripting.htmlhttps://packetstormsecurity.com/files/164183/Cloudron-6.2-Cross-Site-Scripting.htmlhttps://www.cloudron.io/